This vulnerability affects the Oracle Customer Interaction History component of Oracle E-Business Suite, specifically versions 12.2.3 through 12.2.15. It allows an attacker with low privileges and network access via HTTP to gain unauthorized update, insert, delete, and read access to certain data within the product. The CVSS 3.1 base score is 5.4, reflecting low complexity of attack (AC:L), network attack vector (AV:N), and no user interaction required (UI:N). The vulnerability is related to improper access control (CWE-284). The vendor advisory does not explicitly confirm a patch or remediation status for this specific vulnerability but references a Critical Patch Update containing many patches. Customers are advised to apply patches promptly as per Oracle's general guidance.

Successful exploitation results in unauthorized read and write access to some data in Oracle Customer Interaction History, impacting confidentiality and integrity of that data. There is no impact on availability. The attacker requires network access and low privileges but no user interaction is needed. This could lead to unauthorized modification or disclosure of sensitive customer interaction data.

The vendor advisory does not explicitly confirm a patch or remediation for this vulnerability. Oracle recommends customers remain on actively supported versions and apply Critical Patch Updates without delay. Users should monitor Oracle's July 2026 Critical Patch Update advisory for patch availability and apply relevant patches promptly once released. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.